BCH fast soft decoding beyond the (d-1)/2 bound

ABSTRACT

A method for Bose-Chaudhuri-Hocquenghem (BCH) soft error decoding includes receiving a codeword x, wherein the received codeword x has τ=t+r errors for some r≥1; computing a minimal monotone basis {λi(x)}1≤i≤r+1⊆F[x] of an affine space V={λ(x)ϵF[x]: λ(x)·S(x)=λ′(x) (mod x2t), λ(0)=1, deg(λ(x)≤t+r}, wherein λ(x) is an error locator polynomial and S(x) is a syndrome; computing a matrix A≡(λjβi))iϵ[W],jϵ[r+1], wherein W={βi, . . . , βW} is a set of weak bits in x; constructing a submatrix of r+1 rows from sub matrices of r+1 rows of the subsets of A such that the last column is a linear combination of the other columns; forming a candidate error locating polynomial using coefficients of the minimal monotone basis that result from the constructed submatrix; performing a fast Chien search to verify the candidate error locating polynomial; and flipping channel hard decision at error locations found in the candidate error locating polynomial.

TECHNICAL FIELD

Embodiments of the disclosure are directed to algorithms for deterministically decoding Bose-Chaudhuri-Hocquenghem (BCH) codes with up to r errors beyond the (d−1)/2 hamming distance in error patterns that occur with very high probability, which improve the raw bit error rate (BER) coverage of BCH and soft-BCH (SBCH) codes.

DISCUSSION OF THE RELATED ART

A widely known and broadly used BCH soft decoding scheme due to Chase deterministically decodes BCH codes by randomly flipping weak bits and then performing full hard decision (HD) BCH decoding per flip. Other prior-art fast Chase decoders use partial decoding per iteration, but the decoder covers smaller range of error patterns. The fast Chase of Wu, et al., increased soft decoding capability in comparison to Chase soft decoding, which offered an improvement over the classical HD BCH decoder. However, the prior art algorithms require essentially t+r operations per iteration by processing entire error-locator-polynomial (ELP)-type polynomials, and can decode only when the number of weak bits that are errors ≥r+1.

SUMMARY

Embodiments of the present disclosure provide methods of: (1) finding and proving a dimension bound to the linear space solutions of the (t+r)-key-equations; (2) Reduction of the core processing to a small evaluation set that is linked to an r-size linear basis of the key equations; (3) Vast computational sharing between iterations; and (4) Combinatorial ordering that govern the solution of related linear equations. Embodiments of the present disclosure afford complexity reduction when there are more errors in the set of weak bits. Embodiments of the present disclosure further provide soft decoding capability beyond Wu's algorithm.

Algorithms according to embodiments of the present disclosure use r operations per iteration by passing from an evaluation set of a basis to ELP-type polynomials, can decode when the number of weak bits that are errors ≥r−1, and provide a substantial reduction in complexity as the number of errors in the weak bits increases. A design according to embodiments of the disclosure enables decoding whenever the number of weak bits that are errors ≥r+1 and

${{r \cdot \begin{pmatrix} w \\ {r + 1} \end{pmatrix}} \leq C},$ and also whenever the number of weak bits that are errors ≥r−1 and

${{c \times n \times \begin{pmatrix} w \\ r \end{pmatrix}} \leq C},$ where w is the number of weak bits, c>0, and C>0 is the complexity budget.

According to an embodiment of the disclosure, there is provided a computer-implemented method of Bose-Chaudhuri-Hocquenghem (BCH) soft error decoding, including receiving a codeword x through a communication channel, wherein the received codeword x has τ=t+r errors for some r≥1, wherein t=(d−1)/2 and d is a minimal distance of a BCH code; computing a minimal monotone basis {λ_(i)(x)}_(1≤i≤r+1)⊆F[x] of an affine space V={λ(x)ϵF[x]:λ(x)·S(x)=λ′(x) (mod x^(2r)), λ(0)=1, deg(λ(x)≤t+r}, wherein λ(x) is an error locator polynomial, S(x) is a syndrome, and F[x]=GF(q) wherein q=2^(m) for m>1; computing a matrix A≡(λ_(j)(β_(i)))_(iϵ[W], jϵ[r+1]), wherein W={β₁, . . . , β_(W)} is a set of weak bits in x; and processing for every subset W′⊆W by retrieving from memory a set W″=R(W′), computing B_(W′) by adding one row to B_(W″) and performing Gaussian elimination operations on B_(W′), wherein R(W′) is reliability probabilities of the bits in W′. When a first r′ columns of B_(W′) are a transpose of a systematic matrix and deg(λ(x))=t+r′, wherein 1≤r′≤r, the method further includes performing computing u(x)=gcd(λ(x), λ′(x)), wherein λ′(x) is a derivative of λ(x); computing λ(Φ\W′) and deducting from it Z_(λ(x),Φ) wherein Z_(λ(x),Φ)={βϵΦ: λ(β)=0}, when u(x) is a scalar in F*; adding a pair (λ(x), Z_(λ(x),Φ)) to set a L of all (r′, λ(x), Z_(λ(x),Φ)) such that 1≤r′≤r, λ(x)ϵV′_(r′), |Z_(λ(x),W)|≥r′+1, and Z_(λ(x),Φ)|=t+r′, when |Z_(λ(x),Φ)|=t+r′; and outputting the set L.

According to a further embodiment of the disclosure, the one row added to B_(W″) is an arbitrary odd-square polynomial in the codeword x.

According to a further embodiment of the disclosure, the method includes forming the error locating polynomial from coefficients in the set L, and flipping channel hard decisions at error locations found in the received codeword.

According to a further embodiment of the disclosure, λ(x)ϵV_(r′) is unique and λ(β)=0 for every βϵW′, when the first r′ columns of B_(W′) are a transpose of a systematic matrix.

According to a further embodiment of the disclosure, the method includes terminating the processing of W′ when deg(u(x))≥1.

According to a further embodiment of the disclosure, the method includes terminating the processing of W′ when the first r′ columns of B_(W′) are not a transpose of a systematic matrix or deg(λ(x))≠t+r′.

According to a further embodiment of the disclosure, the method includes, before computing u(x)=gcd(λ(x),λ′(x)), computing, for every r≥ρ≥r′+2 and a pair (W₁, λ₁(x)) such that λ(x)ϵV′_(ρ) and W₁⊆W with |W₁|=ρ+1, wherein λ₁(x)ϵV_(ρ) is a unique polynomial such that λ₁(W₁)=0, λ₁′(β) for every β in W₁.

According to a further embodiment of the disclosure, the method includes terminating the processing of W₁ when for any β in W₁, λ₁′(β)=0.

According to an embodiment of the disclosure, there is provided a non-transitory program storage device readable by a computer, tangibly embodying a program of instructions executed by the computer to perform method steps for a Bose-Chaudhuri-Hocquenghem (BCH) soft error decoding. The method includes receiving a codeword x through a communication channel, wherein the received codeword x has τ=t+r errors for some r≥1, wherein t=(d−1)/2 and d is a minimal distance of a BCH code; computing a minimal monotone basis {λ_(i)(x)}_(1≤i≤r+1)⊆F[x] of an affine space V={λ(x)ϵF[x]: λ(x)·S(x)=λ′(x)(mod x^(2t)), λ(0)=1, deg(λ(x)≤t+r}, wherein λ(x) is an error locator polynomial, S(x) is a syndrome, and F[x]=GF(q) wherein q=2^(m) for m>1; computing a matrix A≡(λ_(j)(β_(i)))_(iϵ[W], jϵ[r+1]), wherein W={β₁, . . . , β_(W)} is a set of weak bits in x; constructing a submatrix of r+1 rows from sub matrices of r+1 rows of the subsets of A such that the last column is a linear combination of the other columns; forming a candidate error locating polynomial using coefficients of the minimal monotone basis that result from the constructed submatrix; performing a fast Chien search wherein the candidate error locating polynomial is verified; and flipping channel hard decision at error locations found in the candidate error locating polynomial and returning the decoded codeword x.

According to a further embodiment of the disclosure, constructing a submatrix of r+1 rows from sub matrices of r+1 rows of the subsets of A such that the last column is a linear combination of the other columns includes processing for every subset W′⊆W by retrieving from memory a set W″=R(W′), computing B_(W′) by adding one row to B_(W″) and performing Gaussian elimination operations on B_(W′), wherein R(W′) is reliability probabilities of the bits in W′. When a first r′ columns of B_(W′) are a transpose of a systematic matrix and deg(λ(x))=t+r′, wherein 1≤r′≤r, the method includes performing computing u(x)=gcd(λ(x), λ′(x)), wherein λ′(x) is a derivative of λ(x); computing λ(Φ\W′) and deducting from it Z_(λ(x),Φ) wherein Z_(λ(x),Φ)={βϵΦ: λ(β)=0}, when u(x) is a scalar in F*; adding a pair (λ(x), Z_(λ(x),Φ)) to set a L of all (r′, λ(x), Z_(λ(x),Φ)) such that 1≤r′≤r, λ(x)ϵV′_(r′), |Z_(λ(x),W)|≥r′+1, and |Z_(λ(x),Φ)|=t+r′, when |Z_(λ(x),Φ)|=t+r′; and outputting the set L.

According to an embodiment of the disclosure, there is provided a computer memory-based product, including a memory; and a digital circuit tangibly embodying a program of instructions executed by the computer to perform a method or a Bose-Chaudhuri-Hocquenghem (BCH) soft error decoding.

According to a further embodiment of the disclosure, the memory is at least one of a solid-state drive, a universal flash storage, or a DRAM.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flow chart of an error decoding algorithm according to an embodiment of the disclosure.

FIG. 2 is a block diagram of a new architecture for implementing an error decoding algorithm, according to an embodiment of the disclosure.

FIG. 3 is a block diagram of a system for implementing a new architecture for an error decoding algorithm according to an embodiment of the disclosure.

DETAILED DESCRIPTION

Introduction—Part 1

Let m>1, q=2^(m), F=GF(q), d is minimal distance of the BCH code, t=(d−1)/2, and α be primitive elements of F. 1<n<2^(m) is the BCH code length and k=n−2t is the code dimension. Consider a BCH code whose evaluation set is A={α¹, . . . , α^(n)}, and parity check matrix is H=(α^(i·j) such that 1≤i≤2t, 1≤j≤n).

A codeword X=(x₁, . . . , x_(n))ϵGF(2)^(n) was transmitted and a word Y=(y₁, . . . , y_(n))ϵGF(2)^(n) is received. The error word is e=Y−X=(e₁, . . . , e_(n)) and E={α^(u) such that e_(u)=1} is the set of error locations. The decoder computes a standard BCH syndrome: [S₀, . . . , S_(d−2)]^(T)=H·Y=H·e, which is a vector in F^((d−1)). The syndrome polynomial is S(x)=Σ_(0≤i≤d−2) S _(i) ·x ^(i).

The receiver tries at first to decode with the standard Berlekamp-Massey (BM) algorithm combined with a Chien search. If it fails it proceeds with a proposed fast soft decoding according to an embodiment of the disclosure. Failing BM means that the received word has τ=t+r errors for some r≥1. The set of errors locations is denoted by E₀={α₁, . . . , α_(τ)}⊆A, where E₀ is unknown to the decoder. The following algorithm succeeds whenever the number of errors is 1≤r′≤r. Initially the soft decoder observes a set W⊆A of weak bits. Typically w≡|W|<<n. The error locator polynomial (ELP) polynomial is defined by: λ*(x)=Π_(1≤j≤t+r)(1−x·α _(j)).

Set E={1/β:βϵE₀}. For βϵF it holds that βϵE iff λ*(β)=0. The task of the following soft decoding algorithm is to first find λ*(x) and then E. Evoking the BCH key equations, the following affine polynomial space is defined: V={λ(x)ϵF[x]such that λ(x)·S(x)=λ′(x)(mod x ^(d−1)), and λ(0)=1,deg(k(x))t+r}, and U=V+λ*(x).

By the above λ*(x)ϵV, and it has been proved that dim(U)=dim*(V)≤r, and U={λ(x)ϵF[x]such that λ(x)·S(x)=λ′(x)(mod x ^(d−1)), and λ(0)=0,deg(λ(x))≤τ}. Note also that U=V+λ(x) for every λ(x)ϵV.

When |E∩W|≥r+1, an algorithms according to an embodiment has complexity

${C\left( {w,r} \right)} = {{O\left( {r \cdot \begin{pmatrix} w \\ {r + 1} \end{pmatrix}} \right)}.}$

W can be determined, e.g., by log-likelihood ratios, such that this will be the common case. In fact, the larger |E∩W| is, the faster the algorithm becomes.

Introduction—Part 2

Following the above notations, set m≥1, q=2^(m), F=GF(q), and let d=2t+1 be the code minimal distance and t+r (t≥r≥1) the maximal number of errors that ensuing algorithm can correct. This section provides an overview of the BCH soft decoding procedure without the details of the ECC and BCH context, without details of the building of the basis to V, and mathematical proofs.

In an embodiment, a false alarm (FA) means any processing, beyond minimal, of a polynomial, checked by the algorithm, which is not the actual ELP. In particular, it includes unnecessarily activating the computationally heavy Chien search. An algorithm according to an embodiment has a built in mechanism that minimizes the usage of Chien search and reduces other verifications when FA emerges. In particular an algorithm according to an embodiment foresees bursts of FAs and detects them with reduced complexity. Such FAs may result from an ELP with multiple errors in the weak bits.

In a standard BCH soft decoding algorithm, called a Chase algorithm, each probe requires a Chien search, performed by q×t products, while an algorithm according to an embodiment requires O(r) products on average, a massive reduction. The proof of the low expected number of Chien search is based on two BCH probability bounds, known as probability bounds 1 and 2 (PB1, PB2), which state that a false alarm probability is upper bounded by q⁻¹, or even q^(−s), with s>1 in some cases of interest.

For N≥1, b(x)=Σ_(0≤k<N)b_(k)x^(k)ϵF[x] is called odd-square if for all 0≤k<(N−1)/2: b_(k) ²=b_(2k+1). In the following overview the main input of an algorithm according to an embodiment is a random odd-square polynomial b(x)ϵF[x]. This is a generalized form of a syndrome polynomial.

A polynomial B(x) can be transformed into to a binary vector. For example, if B(x)=1+x+x³+x⁵, the binary vector is 110101.

Note that a computation of the GCD (greatest common divisor) of two polynomials of degree ≤N with the Euclidean algorithm can be performed with N² products.

A theoretical justification of the algorithms presented below is provided in the Appendix that follows this Detailed Description.

Input

In this general setting the input of the algorithm is:

(1) b(x)ϵF[x], an arbitrary odd-square polynomial—this is the binary codeword;

(2) integers (t, r, n, m) where 2^(m)>n>t≥r≥1, n>w≥r+1 and F=GF(2^(m));

(3) sets W⊆Φ⊆F* wherein F* is a finite field, such that n=|Φ| and w=|W|.

Here Φ stands for the evaluation set of the code, which is an auxiliary calculation that assists in the decoding, and W for the weak bits as explained below. The weak bits are those for which the probability of being correct is low.

Setting, Notations, Processing Principle, and Running Memory

For 0≤r′≤r define: V _(r) ′≡V _(2t,t+r′,b(x))≡{λ(x)ϵF[x]:λ(x)·b(x)=λ′(x)(mod x ^(2t)),deg(λ(x))≤t+r′,λ(0)=1}, V′ _(r′)={λ(x)ϵF[x]:λ(x)·b(x)=λ′(x)(mod x ^(2t)),deg(λ(x))=t+r′,λ(0)=1}, V≡V _(r), and write W={β₁, . . . , β_(W)}, where the β_(i) are the probabilities and indices of the weak bits. Note that it can be assumed without loss of generality that dim(V)=r. ⋄ For every λ(x)ϵF[x] and a set U⊆F, define λ(U)={λ(β):βϵU}, Z _(λ(x),U) ={βϵU:λ(β)=0}.⋄

Take 1≤r′≤r. Note that by the uniqueness lemma, if λ(x)ϵV_(r′) is separable, and for Z⊆F, |Z|≥r′, Z is a zero set for λ(x), i.e., λ(Z)={0}, then λ(x) is the only polynomial in V_(r′) for which Z is a zero set. ⋄

Definition. For Q⊆W define Q*={iϵ[w]: β_(i)ϵQ}.

Define A≡(λ_(j)(β_(i)))_(iϵ[w],jϵ[r+1]′), and for Q⊆W define A_(Q) to be the matrix obtained from A by omitting all rows that are not in Q* and B_(Q) is the unique reduced row echelon (RRE) matrix, also referred to as a semi systematic matrix, whose row space is equal to the row space of A_(Q). ⋄

A matrix B is called systematic if B=[I, C], i.e., B is the concatenation of I and C into one matrix, where I the unit matrix. ⋄

Set ordering and the processing principle.

The subsets of W are ordered by a total order, <, typically lexicographic, e.g. a depth first order, wherein for any W₁ and W₂, subsets of W such that |W_(i)|≤r+1, if W₁<W₂ then W₁ is processed before W₂. There is a mapping R such that for every W′⊆W, 1≤|W′|≤r+1 there is W″=R(W′)⊆W′, which is unique, with |W″|=|W′|−1, such that the following holds:

(1) Running memory. For every W′⊆W and j≡|W′|≤r+1, the running memory stored before W′ is processed, contains {B_(W′(i)):iϵ[j]} where Ø=W(0)<W′(1)<W′(2)< . . . <W′(j)=W′ and for iϵ[j]: |W′(i)|=i, and R(W(i))=W(i−1), which implies that the running memory is very small.

(2) Computation sharing. For every W′⊆W with |W′|←r+1, when W′ is processed the decoder computes at first B_(W′). It is performed after retrieving from memory the matrix B_(R(W′)), and then performing a minimal amount of delta Gaussian elimination operations to compute B_(W′). It takes an average of O(r) products per W′.

Output

An algorithm according to an embodiment is a list decoder, which is a decoder whose output a list of codewords. One codeword in the list is the original valid codeword. The output is the set L, which is an array of codewords, of all (r′, λ(x), Z_(λ(x),Φ)) such that: 1≤r′≤r,λ(x)ϵV′ _(r′) ,|Z _(λ(x),W) |≥r′+1, and |Z _(λ(x),Φ) |=t+r′. Steps

FIG. 1 is a flowchart of an error decoding algorithm according to an embodiment of the disclosure. Referring now to the figure, an algorithm according to an embodiment begins at step 101 by receiving a codeword x.

An algorithm according to an embodiment computes first, at step 102, a minimal monotone basis of V: {λ_(i)(x)}_(1≤i≤r+1)⊆F[x], and then, at step 103, computes the matrix A defined above, and computes also: {λ_(j)(β):βϵΦ\W,jϵ[r+1]}.

Methods for computing the minimal monotone basis of V and the matrix A are known in the art.

(ii) At step 104, an algorithm according to an embodiment goes through every set W′⊆W, with |W′|≤r+1, in accordance with the order <. When W′⊆W, with r′+1≡|W′|≤r+1, is processed the decoder retrieves from the running memory W″=R(W′), which is read data and reliability probabilities, and computes a basis B_(W′) by adding the polynomial vector b(x) as one row to B_(W″) and performing a minimal number of Gaussian elimination operations to yield a set of codewords. If, at step 105, the first r′ columns of B_(W′) are a transpose of a systematic matrix, there is an instant check that tells the decoder if there exists a unique λ(x)ϵV_(r′) such that λ(β)=0 for every βϵW′. If the answer is positive and, deg(λ(x))=t+r′, the following steps take place, otherwise the processing of W′ ends at step 109, where the set L is output.

(s1) At step 106, apply the Euclidean algorithm to compute u(x)=gcd(λ(x),λ′(x)).

(s2) At step 107, if u(x) is a scalar in F* (i.e., λ(x) is separable) compute λ(Φ\W′) (i.e. Chien search) and deduct from it Z_(λ(x),Φ), otherwise if deg(u(x))≥1 the processing of W′ ends at step 109.

(s3) At step 108, if u(x) is a scalar and |Z_(λ(x),Φ)|=t+r′, the pair (λ(x), Z_(λ(x),Φ)) is added to L.

As mentioned above, this processing requires O(r) products on average instead of the standard O(r³) in a prior art scheme.

Comments and Further Reduction of False Alarm In Some Distinct Cases

(1) Following (i), in an algorithm according to an embodiment, the computation of λ(U) for λ(x)ϵV_(r′) and a subset U⊆F, e.g. Chien search when U=Φ, is done in a fast mode that requires r′ products for each β, instead of t+r′ in the standard method. This is due to the fact that λ(x)−λ_(r+1)(x) is a linear combination of {λ_(i)(x)}_(1≤i≤r′)⊆F[x]. (2) It follows from the Probability Bound 2 (PB2), described in the appendix below, that in BCH decoding, for W′⊆W, with |W′|=r′+s (s≥1) the probability that there exists λ(x)ϵV′_(r′) which is not the ELP such that λ(W′)={0}, is upper bounded by q^(−s)/(1−q⁻²). Observe that if s=1, then no product of λ(x) will appear again in the algorithm. (3) Suppose that s=a+1, where a≥1 and r≥r′+a+1=r′+s and there exists W′⊆W with |W′|=r′+s, and a separable λ(x)ϵV′_(r′), such that λ(W′)={0}. Such event can be portrayed as an event of an overflow of zeros within W per a polynomial in V, in comparison to its degree. (4) It follows from the supposition in (3) that for every 1≤b≤a such that: r′+2b≤r and r′+1+a+b≤w, take any mutually different β₁, . . . , β_(b)ϵW\W′, and define: λ₁(x)≡(1−β₁ ·x)²· . . . ·(1−β_(a) ·x)²·λ(x) and W ₁ ≡W′∪{β ₁, . . . ,β_(a)}.

It holds that λ₁(x) might be processed, unnecessarily, by an above algorithm according to an embodiment as part of the handling of the subset W₁. The likelihood of this unwanted occurrence follows from the fact that: deg(λ₁(x))=t+r′+2b,W ₁ ⊆W,|W ₁ |=r′+a+b+1,a≥b, and λ₁(W ₁)={0}.

While the incidence of (3) is very rare in the case that λ(x) is not an ELP, (see (2) above), it can occur sometimes when λ(x) is ELP. It depends on the input of the algorithm. When (3) occurs, for some λ(x)ϵV′_(r′), in an embodiment, the decoder performs the following preliminary step, (s0), prior to (s1) under the following condition with respect to the minimal r′ that satisfies (3):

(s0) For every r≥ρ≥r′+2 and a pair (W₁, λ₁(x)) such that λ(x)ϵV′_(ρ) and W₁⊆W with |W₁|=ρ+1, wherein λ₁(x)ϵV_(ρ) is the unique polynomial such that λ₁(W₁)=0, the decoder computes λ₁′(β) for every β in W₁, and if for any β in W₁, λ₁′(β)=0, the processor ends the processing of W₁. ⋄

Observe that if λ₁′(β)=0 for some β in W₁ then λ₁(x) is not separable. Note also that the computation of λ₁′(β) requires only (t+φ/2 products.

Overview

A decoding system according to an embodiment is shown in FIG. 2 . According to an embodiment, denote by x={x_(i)}_(i=1) ^(n) the (n, k, d) BCH code word, where x_(i)ϵGF(2), k is the code dimension, n is the code length and d is the BCH code minimal distance. The codeword is transmitted through a channel 10 with independent and identically distributed transition probability P(z|x), where zϵ

and xϵGF(2). The hard decision decoder 11 receives the channel output and decodes a codeword {circumflex over (x)}. Denote the log likelihood ratio of symbol i given the channel value z_(i) as

${R_{i} = {\log\left( \frac{P\left( {\left. z_{i} \middle| x \right. = 0} \right)}{P\left( {\left. z_{i} \middle| x \right. = 1} \right)} \right)}},$ and y as the channel hard decision, where

$y_{i} = \left\{ {\begin{matrix} 0 & {{LLR}_{i} \geq 0} \\ 1 & {o.w.} \end{matrix}.} \right.$ A classic BCH decoder 12 is applied to y. If |{j|x_(j)≠y_(j) for 1≤i≤n}|>t, where

${t = \left\lfloor \frac{d - 1}{2} \right\rfloor},$ the classic BCH decoder fails and a BCH soft decoder 13 according to an embodiment is applied.

According to an embodiment, an overview of a BCH soft decoder algorithm is as follows.

Input: z, y

Output: {circumflex over (x)}

1. Find a set of w weak bits locations (lowest likelihood ratio): W={β _(i)}_(1≤i≤w),β_(i)=α^(ji) ,j _(i)ϵ[0,n−1]. 2. Solution to t+r key equation forms an r dimensional affine space. Find a monotone affine basis: Λ={λ₁(x) . . . λ_(r+1)(x)}. In high probability, the ELP is given as affine combination of this basis: λ(x)=b ₁·λ₁(x)+b ₂·λ(x)+ . . . b _(r)·λ_(r)(x)+λ_(r+1)(x). 3. Look efficiently for r+1 from w locations that zero the ELP polynomial with some coefficients {b_(i)}_(1≤i≤r): a. Compute the solution matrix:

$A = {\left\{ {a_{ij} = {\lambda_{j}\left( \beta_{i} \right)}} \right\}_{{1 \leq i \leq w},{1 \leq j \leq {r + 1}}} = \begin{bmatrix} a_{1,1} & \ldots & a_{1,{r + 1}} \\  \vdots & \ddots & \vdots \\ a_{w,1} & \ldots & a_{w,{r + 1}} \end{bmatrix}}$ b. Go over all combination of sub matrices of r+1 rows of the subsets of A, to find submatrix of r+1 rows such that the last column is a linear combination of the other columns. This part receives the coefficients of the affine base b and r+1 error locations. This is the main part of the algorithm and it is described in detail above in steps (ii), s1, s2 and s3. Computation sharing reduces the complexity of each check from O(r³) to O(r). c. Form the candidate ELP using the resulting coefficients. 4. Fast Chien search to verify the candidate ELP and error locations. 5. Flip the channel hard decision at the error locations found in step 3 and return the decoded word {circumflex over (x)}. System Implementations

It is to be understood that embodiments of the present disclosure can be implemented in various forms of hardware, software, firmware, special purpose processes, or a combination thereof. In one embodiment, the present disclosure can be implemented in hardware as an application-specific integrated circuit (ASIC), or as a field programmable gate array (FPGA). In another embodiment, the present disclosure can be implemented in software as an application program tangible embodied on a computer readable program storage device. The application program can be uploaded to, and executed by, a machine comprising any suitable architecture.

In addition, methods and implementations of embodiments of the disclosure can be used or incorporated into any memory-based product, such as a solid-state drive (SSD), universal flash storage (UFS) products, DRAM modules, etc.

FIG. 3 is a block diagram of a system for implementing an erasure correction algorithm that uses a neural network to perform matrix inversion, according to an embodiment of the disclosure. Referring now to FIG. 3 , a computer system 31 for implementing the present disclosure can comprise, inter alia, a central processing unit (CPU) or controller 32, a memory 33 and an input/output (I/O) interface 34. The computer system 31 is generally coupled through the I/O interface 34 to a display 35 and various input devices 36 such as a mouse and a keyboard. The support circuits can include circuits such as cache, power supplies, clock circuits, and a communication bus. The memory 33 can include random access memory (RAM), read only memory (ROM), disk drive, tape drive, etc., or a combinations thereof. The present disclosure can be implemented as a routine 37 that is stored in memory 33 and executed by the CPU or controller 32 to process the signal from the signal source 38. As such, the computer system 31 is a general purpose computer system that becomes a specific purpose computer system when executing the routine 37 of the present disclosure. Alternatively, as described above, embodiments of the present disclosure can be implemented as an ASIC or FPGA 37 that is in signal communication with the CPU or controller 32 to process the signal from the signal source 38.

The computer system 31 also includes an operating system and micro instruction code. The various processes and functions described herein can either be part of the micro instruction code or part of the application program (or combination thereof) which is executed via the operating system. In addition, various other peripheral devices can be connected to the computer platform such as an additional data storage device and a printing device.

It is to be further understood that, because some of the constituent system components and method steps depicted in the accompanying figures can be implemented in software, the actual connections between the systems components (or the process steps) may differ depending upon the manner in which the present disclosure is programmed. Given the teachings of the present disclosure provided herein, one of ordinary skill in the related art will be able to contemplate these and similar implementations or configurations of the present disclosure.

While the present disclosure has been described in detail with reference to exemplary embodiments, those skilled in the art will appreciate that various modifications and substitutions can be made thereto without departing from the spirit and scope of the disclosure as set forth in the appended claims.

APPENDIX

1. Analysis of the BCH Key Equations I: Beyond the (D−1)/2 Radius, and the Dimension Equality

1.1 Introduction

Here F=GF(2^(m)), m>1 and the empty sum is zero.

Definition 1:

(i) For an n dimensional vector space V over F and subspace U⊆V, and vϵV we define the dimension of the affine space v+U to be n, and write: dim*_(F)(v+U)=n. (ii) For L≥N≥1, and b(x)=Σ_(0≤k<N)b_(k)x^(k), c(x)=Σ_(0≤k<L)c_(k)x^(k)ϵF[x] we would denote b(x)≤c(x) if for all 0≤k<N it holds that c_(k)=b_(k). Lemma 1. Take λ(x)ϵF[x], where λ(0)=1. Let K be an extension field of F that contains all λ(x) roots. Represent λ(x) by: λ(x)=Π_(1≤j≤s)(1−x·α_(j))^(r(j)) where α₁, . . . , α_(s)ϵK* are mutually different and r(j)≥1. Then the following equality holds: λ′(x)/λ(x)=Σ_(1≤j≤s,r(j) is odd)α_(j)·/(1−x·α _(j)). Proof. We can write λ(x)=β²(x)·Π_(1≤j≤s, r(j) is odd) (1−x·α_(j)) where β(x)ϵK[x]. In other words, every polynomial can be represented uniquely as a product of a square polynomial and a polynomial with roots of multiplicity 1. It then holds that λ′(x)/λ(x)=Σ_(1≤j≤s r(j) is odd)α_(j)·Π_(1≤v≤s,r(v) is odd,v≠j)(1−x·α _(v)), and hence: λ′(x)/λ(x)=Σ_(1≤j≤s,r(j) is odd)α_(j)·/(1−x·α _(j)).♦ Lemma 2. Take λ(x)ϵF[x] with λ(0)=1, and b(x)=Σ_(0≤j≤N−1)b_(j)x^(j)ϵF[x]. Let K be an extension field of F that contains all λ(x) roots. Represent λ(x) by: λ(x)=Π_(1≤j≤s)(1−x·α_(j))^(r(j)) where α₁, . . . , α_(s)ϵK* are mutually different and r(j)≥1. Then λ(x)·b(x)=λ′(x)(mod x ^(N))iff  (1) b _(k)=Σ_(1≤j≤s,r(j) is odd)α_(j) ^(k+1)for all0≤k≤N−1.♦  (2)

Note that here we do not assume anything on the degrees of λ(x) and b(x), not even s≤N. Thus it holds even when b(x)=0. Note also that when (2) holds then for 0≤k<(N−1)/2: b_(k) ²=b_(2k+1).

Proof. Since λ(0)=1, λ(x)·b(x)=λ′(x) (mod x^(N)) is equivalent to b(x)=λ′(x)/λ(x) (mod x^(N)) which is equivalent to: Σ_(0≤k<N) b _(k) x ^(k)=λ′(x)/λ(x)(by lemma1)=Σ_(1≤j≤s,r(j) is odd)α_(j)·/(1−x·α _(j))(mod x ^(N))=Σ_(1≤j≤s,r(j) is odd)Σ_(0≤k) x ^(k)·α_(j) ^(k+1)(mod x ^(N))=Σ_(0≤k≤N−1) x ^(k)·Σ_(1≤k≤s,r(j) is odd)α_(j) ^(k+1)(mod x ^(N)), and this is equivalent to b_(k)=Σ_(1≤j≤s, r(j) is odd) α_(j) ^(k+1) for all 0≤k≤N−1. ♦

The following lemma enables us to skip the even iterations in the BCH Berlekamp Massey algorithm.

Lemma 3. Let λ(x)ϵF[x], λ(0)=1. Suppose that N is odd and M=(N−1)/2 and that b(x)=ϵ_(0≤k≤N)b_(k)x^(k), satisfies b_(M) ²=b_(N) and λ(x)·b(x)=λ′(x)(mod x ^(N)). It then holds that the coefficient of x^(N) in λ(x)·b(x) is zero and λ(x)·b(x)=λ′(x)(mod x ^(N+1))

Proof. Let K be an extension field of F that contains all λ(x) roots. Represent λ(x) by: λ(x)=Π_(1≤j≤s)(1−x·α_(j))^(r(j)) where α₁, . . . , α_(s)ϵK* are mutually different and r(j)≥1. By lemma 2 b _(k)=Σ_(1≤j≤s,r(j) is odd)α_(j) ^(k+1)for all0≤k≤N−1. In addition, b _(N) =b _(M) ²=(Σ_(1≤j≤s,r(j) is odd)α_(j) ^(M+1))²=Σ_(1≤j≤s,r(j) is odd)α_(j) ^(2M+2)=Σ_(1≤j≤s,r(j) is odd)α_(j) ^(N+1) It follows that b_(k)=Σ_(1≤j≤s, r(j) is odd) α_(j) ^(k+1) for all 0≤k≤N. Thus by the other direction of lemma 2: λ(x)·b(x)=λ′(x) (mod x^(N+1)). Since all the odd coefficients of λ′(x) are zero, the coefficients of x^(N)in λ′(x) is zero and hence the coefficients of x^(N) in λ(x)·b(x) is zero. ♦ 1.2 Definitions Definition 2. For N≥1, and b(x)=Σ_(0≤k<N)b_(k)x^(k)ϵF[x], b(x) is odd-square if for all 0≤k<(N−1)/2: b_(k) ²=b_(2k+1). Definition 3. For τ, N, L, ≥1, and b(x)=Σ_(0≤k≤L)b_(k)x^(k)ϵF[x], define V _(N,τ,b(x))={λ(x)ϵF[x]:λ(x)·b(x)=λ′(x)(mod x ^(N)),deg(λ(x))≤τ,λ(0)=1} U _(N,τ,b(x))={λ(x)ϵF[x]:λ(x)·b(x)=λ′(x)(mod x ^(N)),deg(λ(x))≤τ} V _(N,τ,b(x),0)={λ(x)ϵF[x]:λ(x)·b(x)=λ′(x)(mod x ^(N)),deg(λ(x))≤τ,λ(0)=0} U _(N,b(x))={λ(x)ϵF[x]:λ(x)·b(x)=λ′(x)(mod x ^(N))}

It is clear that either V_(N,τ,b(x))=Ø or dim*(V_(N,τ,b(x)))=dim(U_(N,τ,b(x)))−1. By the above lemma that if V_(N,τ,b(x))≠Ø for some τ and L≤N then b(x) is odd-square. Note that if V_(N,τ,b(x)) is not empty and λ(x) is any element of V_(N,τ,b(x)) then λ(x)+V _(N,τ,b(x),0) =V _(N,τ,b(x)) which implies that when V_(N,τ,b(x))≠Ø, dim*(V _(N,τ,b(x)))=dim(V _(N,τ,b(x),0)). 1.3 The Dimension Bound 1 & 2 Lemma 4(Dimension Bound 1). Let τ≥1 and L>N≥1 where N and L are even and b(x)ϵF[x] is odd-square, b(x)=Σ_(0≤k<L)b_(k)x^(k). Then, if V_(L,τ,b(x))≠Ø, dim*(V _(N,τ,b(x)))−dim*(V _(L,τ,b(x)))≤(L−N)/2. Proof. For M≥1 set V_(M)=V_(M,τ,b(x)). It will be shown by induction on even sϵ{0, 1, . . . , L−N} that dim*(V _(N))−dim*(V _(N+s))≤s/2. For s=0: take even 0≤s<L−N, and M=N+s and λ(x)ϵV_(M) and observe that the M coefficient of p(x)=λ(x)·b(x)−λ′(x) is Σ_(0≤j≤τ)λ_(j) ·b _(M−j)+λ_(M+1).

Thus V_(M+1)={λ(x)ϵV_(M): λ_(M+1)+Σ_(0≤j≤τ) λ_(j)·b_(N−j)=0}, i.e. V_(M+1) is (nonempty) affine space which is obtained from V_(M) by one additional linear homogeneous equation. It follows that dim*(V_(M))≤dim*(V_(M+1))+1. Next, by the previous lemma when λ(x)·b(x)=λ′(x) (mod x^(M+1)) then λ(x)·b(x)=λ′(x)(mod x ^(M+2)). And hence V_(M+1)=V_(M+2). Thus shown that dim*(V_(N+s))≤dim*(V_(N+s+2))+1♦ As a corollary we get that: Lemma 5 (Dimension Bound 2). Take τ≥1, L=2τ, and L≥N≥1 where N is even, and b(x)ϵF[x] is odd-square, b(x)=Σ_(0≤k<L)b_(k)x^(k). If there exists a separable σ(x)ϵV_(L,τ,b(x)) such that deg(σ(x))=τ, then: dim*(V _(N,τ,b(x)))≤(L−N)/2. Proof. This lemma follows from the previous lemma and from a claim that (*)V=V _(L,τ,b(x)))={σ(x)},i.e. dim*(V _(L,τ,b(x)))=0.

To prove (*) take any λ(x)ϵV and let K be an extension field of F that contains all the roots of σ(x) and λ(x). We can then represent λ(x)=Π_(1≤j≤s)(1−x·α _(j))^(r(j)) where s≤τ and α₁, . . . , α_(s)ϵK* are mutually different and r(j)≥1 and r(1)+r(2)+ . . . +r(s)≤τ, and, σ(x)=Π_(1≤j≤r)(1−x·β _(j)) where β₁, . . . , β_(r)ϵK* are mutually different. Define A to be the symmetric difference of {β₁, . . . , β_(τ)} and {α_(j) :jϵ[s], r(j) is odd} [the symmetric difference of two sets is the set of elements which is one of the sets and not in their intersection]. By lemma 2: Σ_(1≤j≤r),β_(j) ^(k+1) =b _(k)=Σ_(1≤j≤s,r(j) is odd)α_(j) ^(k+1)for all 0≤k≤−1. That is: 0=Σ_(1≤j≤r),β_(j) ^(k+1)+Σ_(1≤j≤s,r(j) is odd)α_(j) ^(k+1) =E _(αϵA)α^(k+1) for all 0≤k≤−1. Note that |A|≤s+τ≤2τ, thus if A≠Ø we get a contradiction since this yields a linear dependency of the columns of a (2τ)×|A| Vandermonde matrix. Therefore A=Ø and hence λ(x)=σ(x)♦ 1.4 Uniqueness Lemma 1 (UL1) Note that the following lemma uses the fact that F has characteristic 2. Lemma 6: I. For every λ(x)ϵF[x] such that λ(0)=1. There then exists exist unique polynomials λ₁(x),u(x)ϵF[x], such that: λ₁(x)·u ²(x)=λ(x) and λ₁(0)=u(0)=1 and λ₁(x) is separable. II. Suppose that λ(x), b(x)ϵF[x] satisfy: λ(x)·b(x)=λ′(x)(mod x ^(N)) and with λ(0)=1, and let λ₁(x),u(x)ϵF[x], be the unique polynomials λ₁(x),u(x)ϵF[x], such that: λ₁(x)·u ²(x)=λ(x) and λ₁(0)=u(0)=1 and λ₁(x) is separable, then λ₁(x)·b(x)=λ₁′(x)(mod x ^(N)) and λ(0)=1. III. Take τ; N≥1, and b(x)ϵF[x], and suppose that there is a unique λ(x)ϵF[x] such that: λ(x)·b(x)=λ′(x)(mod x ^(N)) and λ(0)=1 and deg(λ(x))≤τ. Then λ(x) is separable. Proof. I. There exist unique λ₁(x),u(x)ϵK[x], in some extension field K, such that: λ₁(x)·u ²(x)=λ(x) and λ₁(0)=u(0)=1. Since u²(x)=gcd(λ(x), λ′(x)) and the gcd is computed by the Euclidean algorithm, then u²(x)ϵF[x] and hence λ₁(x) and u(x) must be in F[x] (and not only in the extension ring K[x]). II. It follows from the assumptions of II that: λ₁(x)·u ²(x)·b(x)=(u ²(x)·λ₁(x))′(mod x ^(N))=u ²(x)·λ₁′(x)(mod x ^(N)). Dividing both sides by u²(x), we get that: λ₁(x)·b(x)=λ₁′(x)(mod x ^(N)). III., Let λ₁(x),u(x)ϵF[x], be the unique polynomials λ₁(x),u(x)ϵF[x], such that: λ₁(x)·u ²(x)=λ(x) and λ₁(0)=u(0)=1 and λ₁(x) is separable. Then by II λ₁(x)·b(x)=λ₁′(x)(mod x ^(N)) and λ(0)=1, and clearly: deg(λ₁(x))≤τ, and hence by the uniqueness u(x)=1 and thus λ₁(x)=λ(x). It follows that λ(x) is separable ♦ 1.5 A Fundamental Rule of Nonhomogeneous Linear Equations

For completeness sake the following known fact is presented.

Fact. Let A be M×(N+1) matrix over a field K (a general field with any characteristic), and B the (M+1)×N matrix over K obtained from A by adding one additional row, called v, at the bottom of A. If for every xϵR={x=[x₁, . . . , X_(N),X_(N+1)]^(T)ϵK^(N+1):x_(N+1)=1} it holds that Ø≠V={xϵR:A·x=0}={xϵR:B·x=0}≡V′, then v is in the row space of A. Proof. Let U={x=[x ₁ , . . . ,x _(N) ,x _(N+1)]^(T) ϵK ^(N+1) :x _(N+1)=0,A·x=0}(the set of solutions to homogeneous equations) U′={x=[x ₁ , . . . ,x _(N) ,x _(N+1)]^(T) ϵK ^(N+1) :x _(N+1)=0,B·x=0},

C* the matrix obtained from the matrix C by omission of the last column (including the case where C comprises one row).

Since Ø≠V′=V then U′=U. It follows that v*=u·A* for some u, a row vector in K^(M). Put w=v−u·A, then w=[0, . . . ,0,ξ] for some ξϵK, and w is in the row space of B, and hence for all xϵV′: w·x=0, thus w=0, which implies that v is in the row space of A. ♦ 1.6 The Dimension Equality Lemma 7 (The Dimension Equality) Take τ≥1, L=2τ, and L≥N≥1 where N is even, and b(x)=Σ_(0≤k<L)b_(k)x^(k)ϵF[x] is odd-square. If there exists a separable σ(x)ϵV_(L,τ,b(x)) such that deg(σ(x))=τ, then: dim*(V _(N,τ,b(x)))=(L−N)/2. Proof. For i≥1 write, V_(i)=V_(i,τ,b(x)). Recall that by lemma 5 dim*(V_(N))≥(L−N)/2. For Nϵ[L] and λ(x)=Σ_(0≤j≤τ)λ_(j)x^(j)ϵF[x] such that λ₀=1, it holds that: λ(x)ϵV_(N) iff λ(x)·b(x)=λ′(x)(mod x ^(N)),  (1)

This is equivalent to: i linear equation L _(i):=Σ_(0≤j≤i)λ_(j) ·b _(i−j)+(i+1)·λ_(i+1)=0 for all 0≤i≤N−1(we define λ_(j)=0for j>τ).  (2)

Note that the i linear equation is independent of N. By lemma 3 above when Nϵ[L−1] is odd, then λ(x)·b(x)=λ′(x)(mod x ^(N)) implies λ(x)·b(x)=λ′(x)(mod x ^(N+1))

Thus, by the fact above, the formal linear equation L_(N) is linearly dependent on the formal linear equations L₁, . . . , L_(N−1) (seen as a vector of coefficients in F^(τ+1)) over F. It follows that (1) is equivalent to: L _(i):=Σ_(0≤j≤i)λ_(j) ·b _(i−j) +i·λ _(i+1)=0 for all even iϵ{0, . . . ,N−1}.  (3)

By lemma 5 above V_(L)={σ(x)}, i.e. dim*(V_(L))=0. Thus when we put in (3) N=L we get that {L_(i):iϵ{0, 2, 4, . . . ,L−2}} is an independent set of τ formal linear equations in τ unknowns. Thus for even Nϵ[L] we get V_(N) is the set of solutions of {L_(i):iϵ{0, 2, . . . , N−2}}. Hence, we reduced the number of independent linear equations by (L−N)/2 and therefore dim(V_(N))=(L−N)/2. ♦

Comment. This proof is also an alternative proof to the uniqueness lemma 2 below. ♦

1.7 Example Related to the Dimension Equality

We had L _(i):≡Σ_(0≤j≤i)λ_(j) ·b _(i−j)+(i+1)·λ_(i+1)=0 for all 0≤i≤N−1 (we define λ_(j)=0 for j>τ). Therefore L ₀:≡λ₀ ·b ₀+λ₁ =b ₀+λ₁=0, L ₁:≡λ₀ ·b ₁+λ₁ ·b ₀ =b ₁+λ₁ ·b ₀=0. Note that b₁+λ₁·b₀=b₀ ²+λ₁·b₀=b₀·(b₀+λ₁), thus L₁ is linearly depends on L₀. 1.8 Applying the Dimension Equality to the Syndrome Polynomial of BCH

Let t≥r≥1 d=2t+1, n>k≥1, where n*−k*=d, and consider an [n*,k*] BCH code, and a transmitted codeword has τ=t+r errors that are located at E={α₁, . . . , α_(τ)}⊆F*. Set E′={1/β:βϵE₀}.

Define for 0≤k≤2τ−1 the syndromes: S _(k)=Σ_(1≤j≤t+r),α_(j) ^(k+1) for all 0≤k≤2τ−1. The decoder knows the syndromes {S_(k)}_(0≤k≤d−2). Define the syndrome polynomial: S(x)=Σ_(0≤k≤2τ−1) , S _(k) ·x ^(k), and define the ELP: λ*(x)=Π_(1≤j≤r)(1−x·α _(j))ϵF[x]. By lemma 2: λ*(x)·S(x)=λ*′(x)(mod x ^(2τ)). Thus by lemma 7 the affine space V_(2τ,τ,S(x)) has dimension 0 and,

(*1) the affine space V=V_(2t,τ,S(x)) has dimension r.

In the following section, this (low) dimension of V plays a role in enabling low complexity. Note that V={λ(x)ϵF[x]:λ(x)·S(x)=λ′(x)(mod x ^(2t)),λ(0)=1deg(λ(x)≤τ}.

The decoder “knows” this space and can find a basis to it.

2. Analysis of the BCH Key Equations II

2.1 Polynomial Divisions for Key Equations Solutions

The recurrence order of (λ(x),σ(x))ϵF[x]², denoted by ord(λ, σ), is defined as ord(λ,σ)=max{degλ,1+degσ}.♦ Lemma 8. I. Take even N≥1 λ(x), γ(x),b(x)ϵF[x], b(x)=Σ_(0≤k≤N−1)b_(k)x^(k), and suppose: (1) λ(0)=1 (2) λ(x)·b(x)=γ(x)(mod x ^(N)). (3) ord(λ,γ)≤N/2, and (λ(x),γ(x)) is the pair with minimal order for which (1)-(3) holds. It then holds that gcd(λ(x),γ(x))=1. Take now σ(x), ω(x), ϵF[x], be such that the same holds: (1) σ(0)=1 (2) σ(x)·b(x)=ω(x)(mod x ^(N)). (3) ord(σ,ω)≤N/2. There then exists c(x)ϵF[x] such that c(0)=1, deg(c(x))>1 and σ(x)=λ(x)·c(x) and ω(x)=γ(x)·c(x). II. If we add the assumption that: (4)λ′(x)=γ(x) and σ′(x)=ω(x), it then holds there exists u(x)ϵF[x], such that u(0)=1 and c(x)=u(x)². [II. follows also from I. and lemma 10 below]. III. It follows the that the other direction of I is also true: if λ(x), γ(x)ϵF[x] satisfy (1)-(3) and gcd(λ(x),γ(x))=1 then (λ(x),γ(x)) is the pair with minimal order for which (1)-(3) holds. Proof. I. If there was g(x)ϵF[x] such that g(x)|λ(x) and g(x)|γ(x) and deg(g(x))>0 then g(0)≠0 and hence we would have g(0)·(λ(x)/g(x))·b(x)=g(0)·(γ(x)/g(x))(mod x^(N)) and contradiction to the minimality of λ(x). Thus gcd(λ(x),γ(x))=1. Next, it holds that b(x)=γ(x)/λ(x) (mod x^(N)) and b(x)=ω(x)/σ(x) (mod x^(N)). Therefore: γ(x)/λ(x)=ω(x)/σ(x)(mod x ^(N)), implying: γ(x)·σ(x)=ω(x)·λ(x)(mod x ^(N)), and therefore by (3): γ(x)·σ(x)=ω(x)·λ(x). Since (λ(x),γ(x))=1 it follows that λ(x)|σ(x). Let c(x)=λ(x)/σ(x), it then holds that c(0)=1 and: γ(x)·λ(x)·c(x)=ω(x)·λ(x) that is:γ(x)·c(x)=ω(x).♦ II. Here we assume λ′(x)=γ(x) and σ′(x)=ω(x). Since σ(x)=λ(x)·c(x) then σ′(x)=λ′(x)·c(x)+λ(x)·c′(x) thus ω(x)=γ(x)·c(x)+λ(x)·c′(x) implying that λ(x)·c′(x)=0,that is c′(x)=0. Claim: for p(x)ϵF[x], if p′(x)=0 then p(x)=q(x)² for some q(x)ϵF[x]. Proof: put p(x)=Σ_(0≤i≤n) a _(i) ·x ^(i) then p′(x)=Σ_(1≤i≤n, i odd) a _(i) ·x ^(i−1). It follows from p′(x)=0 that: p(x)=Σ_(0≤i≤n, i even) a _(i) ·x ^(i), thus: p(x)=(Σ_(0≤i≤n, i even)(a _(i))^(1/2) ·x ^(i/2))² 2.2 Polynomial Divisions for Key Equations Solutions—BCH Generalization Lemma 9. Take N≥1 σ(x), λ(x)ϵF[x], σ(0)=λ(0)=1 and b(x)=Σ_(0≤k≤N−1)b_(k)x^(k)ΣF[x]\{0} and suppose: (1) λ(x)·b(x)=λ′(x)(mod x ^(N)) and σ(x)·b(x)=σ′(x)(mod x ^(N)) (2) N≥deg(λ(x))+deg(σ(x)) (3) σ(x)|λ(x) Then there exists ω(x)ϵF[x], such that ω(0)=1 and λ(x)=ω(x)²·σ(x). Proof. Let K be an extension field of F that contains all λ(x) roots and all σ(x) roots. Represent λ(x) and σ(x) by: (4) λ(x)=Π_(1≤j≤s)(1−x·α _(j))^(r(j)) and σ(x)=Π_(1≤j≤s)·(1−x·α′ _(j))^(r′(j)), where α₁, . . . , α_(s)ϵK* are mutually different and r(j)≥1. Likewise α′₁, . . . , α′_(s)·ϵK* are mutually different and r′(j)≥1. Define A to be the symmetric difference of {α_(j):1≤j≤s, r(j) is odd} and {α′_(j):1≤j≤s′, r′(j) is odd}. It follows from lemma 2 that for 0≤k≤N−1: Σ_(1≤j≤s, r(j) is odd) α_(j) ^(k+1) =b _(k)=Σ_(1≤j≤s′,r′(j) is odd) α′_(j) ^(k+1). That is, 0=Σ_(1≤j≤s, r(j) is odd) α_(j) ^(k+1)+Σ_(1≤j≤s′, r′(j) is odd) α′_(j) ^(k+1)=Σ_(βϵA)β^(k+1). If A≠Ø we get a contradiction since this yields linear dependency of the columns of a N×|A| Vandermonde matrix where |A|≤s+s′≤N. Thus A=Ø and hence s=s′ and: {α_(j):1≤j≤s, r(j) is odd}={α′_(j):1≤j≤s′, r′(j) is odd}. Define f(x)=Π_(1≤j≤s, r(j) is odd)(1−x·α _(j)). By the above, there are polynomials g(x) and h(x) in F[x] such that g(0)=h(0)=1 and: (5) λ(x)=(g(x))² ·f(x) and σ(x)=(h(x))² ·f(x). Since σ(x)|λ(x) then h(x)|g(x). Define ω(x)=g(x)/h(x) then ω(0)=1 and ω(x)²·σ(x)=λ(x). ♦ 2.3 Continuation Principle for Reed-Solomon (RS) Lemma 10. Take N≥1 λ(x), γ(x),b(x)ϵF[x], λ(0)=1, b(x)=Σ_(0≤k≤N−1)b_(k)x^(k), λ(x)=Σ_(0≤k≤τ) λ_(k)x^(k) and suppose: (1) λ(x)·b(x)=γ(x)(mod x ^(N)). (2) deg(γ(x))<τ<N.

It then holds for every L>N that there exists unique {b_(k):N<k≤L}⊆F such that for (3) B(x)=Σ_(0≤k≤L−1) b _(k) x ^(k): (4) λ(x)·B(x)=γ(x)(mod X ^(L)). Proof. Define for k=N:(L−1) define, inductively, in increasing order: (5) b _(k)=Σ_(1≤j≤τ)λ_(j) ·b _(k−j). Since λ₀=1 it is equivalent to (6) 0=Σ_(0≤j≤τ)λ_(j) ·b _(k−j).

This with (1) is equivalent to (4). The uniqueness follows by induction since (6) implies (5). ♦

2.4 Continuation Principle for BCH

Lemma 11. Take L>N≥1 λ(x)ϵF[x], λ(0)=1 and b(x)=Σ_(0≤k≤N−1)b_(k)x^(k)ϵF[x] and suppose that: (1) λ(x)·b(x)=λ′(x)(mod x ^(N)) and deg(λ(x))<N. There then exists {b_(k):N≤k<L}⊆F such that (2) for odd 0<k<L it holds that b _(k) =b ² _((k−1)/2), and for B(x)=Σ_(0≤k≤L−1)b_(k)x^(k): (3) λ(x)·B(x)=λ′(x)(mod x ^(L)). Note that by lemma 9 these {b_(k):N<k≤L} are unique. Proof. Let K be an extension field of F that contains all λ(x) roots. Represent λ(x) by: λ(x)=Π_(1≤j≤s)(1−x·α_(j))^(r(j)) where α₁, . . . , α_(s)ϵK are mutually different and r(j)≥1. By lemma 2 it follows from λ(x)·b(x)=λ′(x)(mod x^(N)) that: b _(k)=Σ_(1≤j≤s, r(j) is odd) α_(j) ^(k+1) for all 0≤k≤N−1.

Define now: b _(k)=Σ_(1≤j≤s, r(j) is odd) α_(j) ^(k+1) for all N≤k≤L−1. Then (2) follows and by the other direction of lemma 2 that (3) holds for B(x)=Σ_(0≤k≤L−1)b_(k)x^(k)♦ 2.5 BCH Probability Bound for Key Equations Solutions 1 (PB1) Lemma 12. Take t>s≥1, and randomly sample an odd-square b(x)=Σ_(0≤k<2t)b_(k)x^(k)ϵF[x], with uniform distribution. I. The probability that there exists separable λ(x)ϵF[x] such that: (1) λ(x)·b(x)=λ′(x)(mod x ^(2t)) and λ(0)=1 and deg(λ(x))=t−s, is upper bounded by q ^(−s). II. The probability that there exists any polynomial λ(x)ϵF[x] such that (1) holds is upper bounded by q^(−s)/(1−1/q²) Proof. I. Recall that the set of odd-square polynomials of degree <2t, is: V={b(x)=Σ_(0≤k<2t) b _(k) x ^(k) ϵF[x]: for all 0≤k<t−1: b _(k) ² =b ₂₊₁}. Define now: W={λ(x)ϵF[x]:λ(x) is separable, λ(0)=1, and deg(λ(x))=t−s}. Note that when b(x)ϵV and λ(x)ϵW satisfies λ(x)·b(x)=λ′(x)(mod x ^(2t)), it also satisfies: (2) λ(x)·b(x)=λ′(x)(mod x ^(2t−2s)) and λ(0)=1 and deg(λ(x))=t−s. For λ(x)ϵW and 1≤j≤t, define: U _(λ(x),j) ={b(x)ϵV:λ(x)·b(x)=λ′(x)(mod x ^(2j))}.

By lemma 11 and its proof, U_(λ(x),t) contains exactly one polynomial and by (2) this polynomial is also in U_(λ(x),t−s). On the other hand, it is clear from the definition and from lemma 10 and its proof that, for b(x)=Σ_(0≤k<2t) b_(k)x^(k)ϵU_(λ(x),t−s) it holds that A={b_(k): 0≤k<2(t−s)} are uniquely determined by the key equations and B={b_(k):2(t−s)≤k<2t, k is even} can be chosen freely from F and C={b_(k):2(t−s)≤k<2t, k is odd} are uniquely determined by A and B through the equation b_(k) ²=b_(2k+1) (for all 0≤k<t−1). It follows that: |U _(λ(x),t−s) |=q ^(s).

Next note that by lemma 11 and its proof for λ₁(x) and λ₂(x)ϵW such that λ₁(x)≠λ₂(x) it holds that U _(λ) ₁ _((x),t−s) ∩U _(λ) ₂ _((x),t−s)=Ø.

Now, randomly sample b(x) from V with uniform distribution and let R be the event that b(x) is in: U≡∪ _(λ(x)ϵW) U _(λ(x),t−s).

Then for some λ(x)ϵW it holds that, b(x) is an (random) element of U_(λ(x),t−s). Hence by the above the probability that b(x) is in U_(λ(x),t) is exactly q^(−s). It follow that the probability that there exists separable λ(x)ϵF[x] such that (1) holds is: Pr(R)·q ^(−s), which proves I. II. It follows from UL1 above (see section 1.4) that that if λ(x)ϵF[x] satisfies (1) above, then there are unique polynomial λ₁(x),u(x)ϵF[x], such that: λ₁(x)·u ²(x)=λ(x) and λ₁(0)=u(0)=1 and λ₁(x) is separable,  (a1) and λ₁(x)·b(x)=λ₁′(x)(mod x ^(2t)).  (a2)

Note that u(x) can also be 1. Let j=deg(u(x)), then and deg(λ₁(x))=t−s−2j. It was proved above that the probability that when we sample b(x) randomly from V, (a2) will be satisfied, is upper bounded by q^(−s−2j). Thus the probability that (1) is satisfied is upper bounded by: q ^(−s)·(1+q ⁻² +q ⁻⁴+ . . . )=q ^(−s)/(1−1/q ²)♦ 2.6 General Polynomial Division Principles Related to RS and BCH Interpolation. For γ₁, . . . , γ_(N), distinct elements of F*, and for every p(x)ϵF[x] with deg(p(x))<N there exists unique coefficients a₁, . . . , a_(N)ϵF such that p(x)=Σ_(jϵ[N]) a _(j)·Π_(iϵ[N]\[j])(1−x·γ _(i)). Proof. For jϵ[N] define p_(j)(x)=Π_(iϵ[N]\[j])(1−x·y_(i)). It is sufficient to prove that {p_(j)(x)}_(jϵ[N]) are linearly independent. Take a₁, . . . , a_(N)ϵF and define p(x)=Σ_(jϵ[N]) a _(j) ·p _(j)(x), it then holds for jϵ[N] that p(1/γ_(j))=a _(j)·Π_(iϵ[N]\[j])(1−γ_(i)/γ_(j)). Thus if p(x)=0 then a_(j)=0 for all jϵ[N]. ♦ Lemma 13. Take N≥1, and any polynomials λ(x),σ(x)ϵF[x] (of any degrees) such that λ(0)=1. There then exists a unique polynomial b(x)=Σ_(0≤k<N) b _(k) x ^(k) ϵF[x]ϵF[x] such that λ(x)·b(x)=σ(x)(mod x ^(N)).  (1) Proof. We represent λ(x)=1+x·λ₁(x), where λ₁(x)ϵF[x]. (1) implies that: b(x)=σ(x)/(1+x·λ ₁(x))(mod x ^(N))=α(x)·(Σ_(0≤i≤N−1)(x·λ ₁(x))^(i))(mod x ^(N)). ♦ Lemma 14. Take any M,N≥1, and λ(x),σ(x)ϵF[x] such that λ(x) is separable and λ(0)=1 and M=deg(λ(x))>deg(σ(x)) and let b(x)=Σ_(0≤k<N) b _(k) x ^(k) ϵF[x] be the unique polynomial (see lemma 13) such that: λ(x)·b(x)=σ(x)(mod x ^(N)).  (1) Let K be an extension field of F that contains all λ(x) roots, we can represent λ(x) by uniquely: λ(x)=Π_(1≤j≤M)(1−x·α _(j)), where α₁, . . . , α_(t)ϵK* are distinct scalars. There exists a₁, . . . , a_(M)ϵF such that b _(k)=Σ_(1≤j≤M) α_(j)·α_(j) ^(k) for all 0≤k<N.  (2) a₁, . . . , a_(M) are unique when M≤N/2. Proof. By the claim above there exists unique a₁, . . . , a_(M)ϵF such that σ(x)=Σ_(jϵ[M]) a _(j)·Π_(iϵ[N]\[j])(1−x·α _(i)). It follows from (1) that:

$\begin{matrix} {{b(x)} = {\sum_{j \in {\lbrack M\rbrack}}{{a_{j}/\left( {1 - {\alpha_{j} \cdot x}} \right)}\left( {{mod}x^{N}} \right)}}} \\ {= {\sum_{j \in {\lbrack M\rbrack}}{a_{j} \cdot {\sum_{0 \leqq i \leq {N - 1}}\left( {\alpha_{j} \cdot x} \right)^{i}}}}} \\ {= {\sum_{0 \leqq i \leq {N - 1}}{\sum_{j \in {\lbrack M\rbrack}}{a_{j} \cdot \left( {\alpha_{j} \cdot x} \right)^{i}}}}} \\ {= {\sum_{0 \leqq i \leq {N - 1}}{x^{i} \cdot {\sum_{j \in {\lbrack M\rbrack}}{a_{j} \cdot \alpha_{j}^{i}}}}}} \end{matrix}.$ This proves (2). The uniqueness, when M≤N/2, follows from the same Vandermonde independency argument as for the BCH. ♦ 3. Analysis of the Key Equations III 3.1 The Uniqueness and Expansion Lemmas

For N, τ≥1 and b(x)ϵF[x] we defined: V _(N,τ,b(x))≡{λ(x)ϵF[x]:λ(x)·b(x)=λ′(x)(mod x ^(N)),deg(λ(x))≤τ,λ(0)=1}.

Note that for all λ(x)ϵV_(N,τ,b(x)) the roots of λ(x) are nonzero. The following lemma eliminates certain singularities in our solution. It implies that if the ELP in V then any polynomial in V that has r roots in W in common with the ELP is in fact that ELP.

Lemma 15 (Uniqueness Lemma 2 (UL2)). Let t≥1, r≥1 and b(x)ϵF[x] is odd-square, b(x)=Σ_(0≤k<L)b_(k)x^(k) and suppose that λ(x),σ(x)ϵV=V_(2t,t+r,b(x)) wherein λ(x) is separable. Suppose also that for some D⊆F*,|D|=r, for every βϵD that λ(β⁻¹)=σ(β⁻¹)=0. It then holds that σ(x)=λ(x). Proof. Let K be an extension field of F that contains all λ(x) roots and all σ(x) roots. We can represent λ(x) and σ(x) by: λ(x)=Π_(1≤j≤t+r)(1−x·α _(j)) σ(x)=Π_(1≤j≤t′+r)(1−x·β _(j))^(r(j))

Where 0≤t′≤t, r(j)≥1 and α₁, . . . , α_(t+r)ϵK* are mutually different and β₁, . . . , β_(t′+r)ϵK* are mutually different. Note that D⊆{α₁, . . . , α_(t+r)} and D⊆{β₁, . . . , β_(t′+r)}. Thus we can assume without loss of generality that α_(i)=β_(i)ϵD for iϵ[r]. Let B={iϵ[r]: r_(j) is even} and b=|B|. Note that t′≤t−b. By lemma 2 for all 0≤k≤2t−1: Σ_(1≤j≤t+r) α_(j) ^(k+1) =b _(k)=Σ_(1≤j≤t′+r, r(j) is odd) β_(j) ^(k+1). Thus for every 0≤k≤2t−1: Σ_(1≤j≤t+r) α_(j) ^(k+1)+Σ_(1≤j≤t′+r, r(j) is odd) β_(j) ^(k+1)=0, that is, Σ_(1≤j≤r, r(j) is even) α_(j) ^(k+1)+Σ_(r+1≤j≤t+r) a _(j) ^(k+1)+Σ_(r+1≤j≤r′+r, r(j) is odd) β_(j) ^(k+1)=0. Let A₁={α_(j):jϵB}, A₂={α_(j): r+1≤j≤t+r}, A₃={β_(j): r+1≤j≤t′+r, r(j) is odd}. It then holds that |A₁|=b and |A₂|=t and |A₃|=t′≤t−b. Thus |A ₁ |+|A ₂ |+|A ₃ |≤b+t+(t−b)≤2t. Note that A ₁ ∩A ₂ =A ₁ ∩A ₃=Ø, and define C=A ₁ ∪A ₂ ∪A ₃ \A ₂ ∩A ₃. Then |C|≤2t and by the above for every 0≤k≤2t−1: Σ_(γϵC)γ^(k+1)=0.

If C is not the empty set we get a contradiction since this yields linear dependency of the columns of a (2t)×|C| Vandermonde matrix where |C|≤2t. Thus C=Ø and hence A₁=Ø and A₂∪A₃=A₂∩A₃, that is A₂=A₃. It follows that λ(x)=σ(x). ♦

Recall that the transformation x→x² is 1-1 linear transformation from F to F over F₂.

Lemma 16 (Expansion Lemma). Let t≥1, r>s≥1, and b(x)ϵF[x] is odd-square, b(x)=Σ_(0≤k<L)b_(k)x^(k) and take λ(x)ϵV_(2t,t+r,b(x)) with deg(p(x))=t+s. It then holds for every p(x)ϵF(x) such that p(0)=1 deg(p(x))≤(r−s)/2 and f(x)=p²(x) that f(x)·λ(x)ϵV_(2t,t+r,b(x)).

Proof. Note that f′(x)=0 and hence for all g(x)ϵF[x](f(x)·g(x))′=f(x)·g′(x), thus since λ(x)·b(x)=λ′(x)(mod x ^(N)) Then f(x)·λ(x)·b(x)=f(x)·λ′(x)(mod x ^(N))=(f(x)·λ(x))′(mod x ^(N)). In addition deg(f(x)·λ(x))≤t+r, and (f·λ(1)=1. Thus f(x)·λ(x)ϵV_(2t,t+r,b(x)). 3.2 The Dimension Bound 3 (DB3) Lemma 17. Let N,τ≥1, b(x)=b(x)=Σ_(0≤k<N)b_(k)x^(k)ϵF[x] is odd-square, then, if V_(N,τ,b(x))≠Ø: Δ=dim*(V _(N,τ+1,b(x)))−dim*(V _(N,τ,b(x)))≤1. Proof. Note that the case τ≥N−1 is trivial: if we add to any basis of V_(N,τ,b(x)), the polynomial λ(x)=x^(τ+1) we get a basis of V_(N,τ+1,b(x)), and hence in this case Δ=1. Assume henceforth that τ<N−1. A polynomial λ(x)=Σ_(0≤i≤τ)λ_(i)x^(i)ϵF[x] is in V_(N,τ,b(x)) iff, λ₀=1 and Σ_(0≤i≤k)λ_(i) ·b _(k−i)+(k+1)λ_(k+1)=0 for all 0≤k<N(we define λ_(i)=0 for i>τ). Likewise a polynomial λ(x)=Σ_(0≤i≤t+1)λ_(i)x^(i)ϵF[x] is in V_(N,τ+1,b(x)) iff λ₀=1 and Σ_(0≤i≤k)λ_(i) ·b _(k−i)+(k+1)λ_(k+1)=0 for all 0≤k<N.

Let δ_(i,k) be the GF(2) Kronecker delta, i.e., for integers i,k: δ_(i,k)=0_(GF(2)) if i=j and δ_(i,k)=1_(GF(2)) if i≠j. Consider the following N row vectors in F^(N+1): v ₀ =[b ₀,1,0, . . . ,0] v ₁ =[b ₁ ,b ₀,0, . . . ,0] v ₂ =[b ₂ ,b ₁ ,b ₀,1, . . . ,0] v ₃ =[b ₃ ,b ₂ ,b ₁ ,b ₀,0, . . . ,0] v ₄ =[b ₄ ,b ₃ ,b ₂ ,b ₁ ,b ₀,1,0, . . . ,0] v ₅ =[b ₅ ,b ₄ ,b ₃ ,b ₂ ,b ₁ ,b ₀,0, . . . ,0] v ₆ =[b ₆ ,b ₅ ,b4₃ ,b ₃ ,b ₂ ,b ₁ ,b ₀,1,0, . . . ,0] V _(N−1) =[b _(N−1) ,b _(N−2) ,b _(N−3) , . . . , b ₂ ,b ₁ ,b ₀,], and let A be the N×N matrix whose rows are v₀, . . . ,v_(N−1) respectively. It then holds that a polynomial λ(x)=1+Σ_(1≤i≤τ)λ_(i)x^(i)ϵF[x] is in V_(N,τ,b(x)) iff A·[1,λ₁, . . . ,λ_(τ),0, . . . ,0]=0, and a polynomial λ(x)=1+Σ_(1≤i≤τ+1)λ_(i) x ^(i) ϵF[x] is in V _(N,τ+1,b(x)) iff A·[1,λ₁, . . . ,λ_(τ),λ_(τ+1),0, . . . , 0]=0. It follows that dim*(V_(N,τ+1,b(x)))−dim*(V_(N,τ,b(x)))≤1♦ As a corollary we get: Lemma 18 (Dimension Bound 3) Let τ≥1, s≥1 b(x)ϵF[x] is odd-square, b(x)=Σ_(0≤k<N) b _(k) x ^(k). Then, if V _(L,τ,b(x))≠Ø: dim*(V _(N,τ+s,b(x)))−dim*(V _(N,τ,b(x)))≤s. 3.3 Dimension Bound 4 (DB4) on a Midway Degree ELP Lemma 19 (Dimension Bound 4). Take t≥r≥r′>r″≥0 and odd-square b(x)ϵF[x] and suppose that

(*) there exists λ(x)ϵV_(2t+2r′,t+r′,b(x)) that is separable of degree t+r′.

It then holds that: I. dim*(V _(2t,t+r′,b(x)))=r′ and dim*(V _(2t,t+r,b(x)))≤r. II. Define r*=max{r ₁ : r ₁ ≤r and dim(V _(2t,t+r(1),b(x)))=r ₁}. Then r′≤r*. III. dim*(V _(2t,t+r″,b(x)))≥r″ Proof. I. By the dimension equality: dim*(V _(2t,t+r′,b(x)))=r′ and by DB3 dim*(V _(2t,t+r,b(x)))−dim*(V _(2t,t+r′,b(x)))≤r−r′. It follows that: dim*(V _(2t,t+r,b(x)))≤r. II. Follows from the proof of I. III. and by DB3 dim*(V_(2t,t+r′,b(x)))−dim*(V_(2t,t+r″,b(x)))≤r′−r″, therefore dim*(V_(2t,t+r″,b(x)))≥r″. ♦ 4. Polynomial Degree Reduction Lemmas, and Probabilistic Bound 4.1 Reducing the Key Equations by One Degree Lemma 20. Take b(x)=Σ_(0≤k<N−1)b_(k)x^(k)ϵF[x] and λ(x)ϵF[x] with λ(0)=1, and suppose that λ(x)·b(x)=λ′(x)(mod x ^(N)),  (1) and that αϵF* is an inverse of a root of λ(x), i.e., (1−α·x)|λ(x). Define λ*(x)=λ(x)/(1−α·x) and b*(x)=Σ_(0≤k<N−1)(b _(k)+α^(k+1))·x ^(j). It then holds that: λ*(x)·b*(x)=λ*′(x)(mod x ^(N))  (2) Proof. Note that b(x)+α/(1−αx)(mod x ^(N)) =b(x)+Σ_(0≤k<∞□)α^(k+1) ·x ^(k) =b*(x)(mod x ^(N)) Thus by (1): λ(x)·b(x)*=(1−α·x)·λ*(x)·(b(x)+α/(1−αx))(mod x ^(N)) =((1−α·x)·λ*(x))′+α·λ*(x)(mod x ^(N)) =((1−α·x)·λ*(x)′+α·λ*(x))+α·λ*(x)(mod x ^(N))=(1−α·x)·λ*(x)′(mod x ^(N)).

Therefore, dividing by (1−αx): λ*(x)·(b(x)+α/(1−αx))=λ*(x)′(mod x ^(N)), which proves (2). ♦ 4.2 Reducing the Key Equation by any Number of Degrees As a corollary to lemma 20 we get that: Lemma 21. Take s≥1, and b(x)=Σ_(0≤k<N−1)b_(k)x^(k)ϵF[x] and λ(x)ϵF[x] with λ(0)=1, and suppose that λ(x)·b(x)=λ′(x)(mod x ^(N)),  (1) and that α₁, . . . , α_(s)ϵF* are mutually different inverses of roots of λ(x), i.e., (1−α_(i)·x)|λ(x), for iϵ[s]& α_(i)≠α_(j) for i,jϵ[s] i≠j. Define λ*(x)=λ(x)/(Π_(iϵ[s])(1−α_(i) ·x)) and b*(x)=Σ_(0≤k<N−1)(b _(k)+Σ_(iϵ[s])α_(i) ^(k+1))·x ^(j). It then holds that: λ*(x)·b*(x)=λ*′(x)(mod x ^(N)).♦  (2) 4.3 BCH Probability Bound for Key Equations Solutions 2 (PB2)

Introduction. Next we arrive at a probabilistic observation. The following event A is a prototype of an event in the main soft decoding algorithm, wherein a solution to the key equation turns out to be a false ELP candidate, and hence requires some additional complexity. It will be shown that this event has probability close to q⁻¹ in first version and close to q⁻² in a second version. In the second version there are an insignificant number of false candidates and consequently insignificant added complexity due to a false alarm that requires a Chien search. ♦

Lemma 22. Take t≥r≥1, s≥1, and b(x)=Σ_(0≤k<2t)b_(k)x^(k)ϵF[x]. Fix mutually different α₁, . . . , α_(r+s)ϵF*. It holds that the probability of the following event, A, is upper bounded by q^(−s)/(1−q⁻²).

The event A: There exists λ(x)ϵF[x] with λ(0)=1, and deg(λ(x))=t+r such that: λ(x)·b(x)=λ′(x)(mod x ^(2t)), and  (1) (1−α_(i) ·x)|λ(x), for iϵ[r+s]& α_(i)≠α_(j) for i,jϵ[r+s]i≠j.  (2) Proof. Define λ*(x)=λ(x)/(Π_(iϵ[r+s])(1−α_(i) ·x)), and b*(x)=Σ_(0≤k<N−1)(b _(k)+Σ_(iϵ[r+s])α_(i) ^(k+1))·x ^(j). By lemma 21 it holds that: λ*(x)·b*(x)=λ*′(x)(mod x ^(2t)) and λ*(0)=1.  (3) Note also that deg(λ*(x))=t−s. It follows from PB1 above that the probability of this event is upper bounded by q^(−s)/(1−q⁻²). 5. Minimal Monotone Basis of Affine Space of Polynomials and Dimensional Setup 5.1 Minimal Monotone Basis

A series of polynomials {p_(i)(x)}_(1≤i≤s) is called monotone if deg(p_(i)(x))<deg(p_(i+1)(x)) for iϵ[s−1]. For an s-dimensional subspace U⊆F[x], A={p_(i)(x)}_(1≤i≤s)⊆F[x] is called monotone basis if A is monotone and also a basis of U. Note while there can be many monotone bases to U, the sequence {deg(p_(i)(x))}_(1≤i≤s) is unique for the given U, and is independent of the monotone basis we choose. A={p_(i)(x)}_(1≤i≤s) is called canonic basis of U if every polynomial in A is monic and if for all iϵ[s], the coefficient of x^(j) for j=deg(p_(i)(x)) is zero for all p_(a)(x), where aϵ[s], a≠i. By [GU] below, the canonic basis is unique. Take p*(x)ϵF[x]\U, and define the affine space W=U+p*(x). B={p_(i)(x)}_(1≤i≤s+1)⊆F[x] is called monotone basis of W if {p_(i)(x)}_(1≤i≤s) is a monotone basis of U and p_(s+1)(x)ϵF[x]\U. B is called minimal monotone basis of W if B is monotone and deg(p_(s+1)(x)) is minimal among all such bases. Note that when B={p_(i)(x)}_(1≤i≤s+1)⊆F[x] is a minimal monotone basis of W, then deg(p_(s+1)(x)) is not in {deg(p_(i)(x))}_(1≤i≤s), and therefore deg(p_(s+1)(x))=min{deg(p(x)):p(x)ϵW}≡μ. On the other hand if p(x)ϵU and deg(p(x))=μ and {p_(i)(x)}_(1≤i≤s) is any monotone basis of U then for p_(s+1)(x)=p(x), it holds that {p_(i)(x)}_(1≤i≤s+1) is a minimal monotone basis of W.

5.2 Main Dimensional Setup for the Algorithm

Take t≥r≥1 and odd-square b(x)ϵF[x] and set V=V_(2t,t+r,b(x)). By the dimension equality, if there exists a separable σ(x)ϵV such that deg(α(x))=t+r, then: (*) dim*(V)=r. In general, given b(x) and r we cannot know in advance if such σ(x) exist, before operating the proceeding algorithm. However, owing to DB4 II (see section 3.3, above), (*) is the only case of interest for the ensuing algorithm. Thus let {λ_(i)(x)}_(1≤i≤r+1)⊆F[x] be a minimal monotone basis of V. Note that we can always find a minimal monotone basis to V by solving the associated linear equations, using Gaussian elimination. Let μ=deg(λ_(r+1)(x)). As mentioned above μ=min{deg(λ(x)):λ(x)ϵV}. In fact V _(2t,μ,b(x))={λ_(r+1)(x)} and for 1≤j: if j<μ: V _(2t,j,b(x))=Ø; if j≥μ: V _(2t,j,b(x))≠Ø. 

What is claimed is:
 1. A digital electronic circuit, tangibly embodying a program of instructions executed by the digital electronic circuit to perform method steps for Bose-Chaudhuri-Hocquenghem (BCH) soft error decoding, comprising the steps of: receiving a codeword x through a digital electronic communication channel, wherein the received codeword x has τ=t+r errors for some r≥1, wherein t=(d−1)/2 and d is a minimal distance of a BCH code; computing a minimal monotone basis {λ_(i)(x)}_(1≤i≤r+1)⊆F[x] of an affine space V={λ(x)ϵF[x]:λ(x)·S(x)=λ′(x) (mod x^(2t)), λ(0)=1, deg(λ(x)≤t+r}, wherein λ(x) is an error locator polynomial, S(x) is a syndrome, and F[x]=GF(q) wherein q=2^(m) for m>1; computing a matrix A≡(λ_(j)(β_(i)))_(iϵ[w], jϵ[r+1]), wherein W={B₁, . . . , β_(w)} is a set of weak bits in x; processing for every subset W′⊆W by retrieving from memory a set W″=R(W′), computing B_(W′) by adding one row to B_(W″) and performing Gaussian elimination operations on B_(W′), wherein R(W′) is reliability probabilities of the bits in W′; and wherein when a first r′ columns of B_(W′) are a transpose of a systematic matrix and deg(λ(x))=t+r′, wherein 1≤r′≤r, performing: computing u(x)=gcd(λ(x), λ′(x)), wherein λ′(x) is a derivative of λ(x); computing λ(Φ\W′) and deducting from it Z_(λ(x),Φ) wherein Z_(λ(x),Φ)={βϵΦ: λ(β)=0}, when u(x) is a scalar in F*; adding a pair (λ(x), Z_(λ(x),Φ)) to set a L of all (r′, λ(x), Z_(λ(x),Φ)) such that 1≤r′≤r, λ(x)ϵV′_(r′), |Z_(λ(x),W)|≥r′+1, and |Z_(λ(x),Φ)|=t+r′, when |Z_(λ(x),Φ)|=t+r′; and outputting the set L to the digital electronic communication channel.
 2. The method of claim 1, wherein the one row added to B_(W″) is an arbitrary odd-square polynomial in the codeword x.
 3. The method of claim 1, further comprising forming the error locating polynomial from coefficients in the set L, and flipping channel hard decisions at error locations found in the received codeword.
 4. The method of claim 1, wherein λ(x)ϵV_(r′) is unique and λ(β)=0 for every βϵW′, when the first r′ columns of B_(W′) are a transpose of a systematic matrix.
 5. The method of claim 1, further comprising terminating the processing of W′ when deg(u(x))≥1.
 6. The method of claim 1, further comprising terminating the processing of W′ when the first r′ columns of B_(W′) are not a transpose of a systematic matrix or deg(λ(x))≠t+r′.
 7. The method of claim 1, further comprising, before computing u(x)=gcd(λ(x),λ′(x)), computing, for every r≥ρ≥r′+2 and a pair (W₁, λ₁(x)) such that λ(x)ϵV′_(ρ), and W₁⊆W with |W₁|=ρ+1, wherein λ₁(x)ϵV_(ρ) is a unique polynomial such that λ₁(W₁)=0, λ₁′(β) for every β in W₁.
 8. The method of claim 5, further comprising terminating the processing of W₁ when for any β in W₁, λ₁′(β)=0.
 9. A non-transitory program storage device readable by a computer, tangibly embodying a program of instructions executed by the computer to perform method steps for a Bose-Chaudhuri-Hocquenghem (BCH) soft error decoding, comprising the steps of: receiving a codeword x through a digital electronic communication channel, wherein the received codeword x has τ=t+r errors for some r≥1, wherein t=(d−1)/2 and d is a minimal distance of a BCH code; performing error correction on the codeword to generate a corrected codeword; and outputting data included in the corrected codeword to the digital electronic communication channel, wherein performing the error correction comprises computing a minimal monotone basis {λ_(i)(x)}_(1≤i≤r+1)⊆F[x] of an affine space V={λ(x)ϵF[x]:λ(x)·S(x)=λ′(x) (mod x^(2t)), λ(0)=1, deg(λ(x)≤t+r}, wherein λ(x) is an error locator polynomial, S(x) is a syndrome, and F[x]=GF(q) wherein q=2^(m) for m>1; computing a matrix A≡(λ_(j)(β_(i)))_(iϵ[w], jϵ[r+1]), wherein W={β₁, . . . , β_(w)} is a set of weak bits in x; constructing a submatrix of r+1 rows from sub matrices of r+1 rows of the subsets of A such that the last column is a linear combination of the other columns; forming a candidate error locating polynomial using coefficients of the minimal monotone basis that result from the constructed submatrix; performing a fast Chien search wherein the candidate error locating polynomial is verified; and flipping channel hard decision at error locations found in the candidate error locating polynomial and returning the decoded codeword x.
 10. The computer-readable program storage device of claim 9, wherein constructing a submatrix of r+1 rows from sub matrices of r+1 rows of the subsets of A such that the last column is a linear combination of the other columns comprises: processing for every subset W′⊆W by retrieving from memory a set W″=R(W′), computing B_(W′) by adding one row to B_(W″) and performing Gaussian elimination operations on B_(W′), wherein R(W′) is reliability probabilities of the bits in W′; wherein when a first r′ columns of B_(W′) are a transpose of a systematic matrix and deg(λ(x))=t+r′, wherein 1≤r′≤r, performing: computing u(x)=gcd(λ(x), λ′(x)), wherein λ′(x) is a derivative of λ(x); computing λ(Φ\W′) and deducting from it Z_(λ(x),Φ) wherein Z_(λ(x),Φ)={βϵΦ: λ(β)=0}, when u(x) is a scalar in F*; adding a pair (λ(x), Z_(λ(x),Φ)) to set a L of all (r′, λ(x), Z_(λ(x),Φ)) such that 1≤r′≤r, λ(x)ϵV′_(r′), |Z_(λ(x),W)|≥r′+1, and |Z_(λ(x),Φ)|=t+r′, when |Z_(λ(x),Φ)|=t+r′; and outputting the set L.
 11. The computer-readable program storage device of claim 10, wherein the one row added to B_(W″) is an arbitrary odd-square polynomial in the codeword x.
 12. The computer-readable program storage device of claim 10, wherein λ(x)ϵV_(r′) is unique and λ(β)=0 for every βϵW′, when the first r′ columns of B_(W′) are a transpose of a systematic matrix.
 13. The computer-readable program storage device of claim 10, the method further comprising terminating the processing of W′ when deg(u(x))≥1.
 14. The computer-readable program storage device of claim 10, the method further comprising terminating the processing of W′ when the first r′ columns of B_(W′) are not a transpose of a systematic matrix or deg(λ(x))≠t+r′.
 15. The computer-readable program storage device of claim 10, the method further comprising, before computing u(x)=gcd(λ(x),λ′(x)), computing, for every r≥ρ≥r′+2 and a pair (W₁, λ₁(x)) such that λ(x)ϵV′_(ρ), and W₁⊆W with |W₁|=ρ+1, wherein λ₁(x)ϵV_(ρ) is a unique polynomial such that λ₁(W₁)=0, λ₁′(β) for every β in W₁.
 16. The computer-readable program storage device of claim 15, the method further comprising terminating the processing of W₁ when for any β in W₁, λ₁′(β)=0.
 17. A computer memory-based product, comprising: a memory; and a digital circuit tangibly embodying a program of instructions executed by the computer to perform a method for a Bose-Chaudhuri-Hocquenghem (BCH) soft error decoding, wherein the method comprises the steps of: receiving a codeword x through a digital electronic communication channel, wherein the received codeword x has τ=t+r errors for some r≥1, wherein t=(d−1)/2 and d is a minimal distance of a BCH code; performing error correction on the codeword to generate a corrected codeword; and outputting data included in the corrected codeword to the digital electronic communication channel, wherein performing the error correction comprises computing a minimal monotone basis {λ_(i)(x)}_(1≤i≤r+1)⊆F[x] of an affine space V={λ(x)ϵF[x]:λ(x)·S(x)=λ′(x) (mod x^(2t)), λ(0)=1, deg(λ(x)≤t+r}, wherein λ(x) is an error locator polynomial, S(x) is a syndrome, and F[x] GF(q) wherein q=2^(m) for m>1; computing a matrix A≡(λ_(j)(β_(i)))_(iϵ[w], jϵ[r+1]), wherein W={β₁, . . . , β_(w)} is a set of weak bits in x; processing for every subset W′⊆W by retrieving from memory a set W″=R(W′), computing B_(W′) by adding one row to B_(W″) and performing Gaussian elimination operations on B_(W′), wherein R(W′) is reliability probabilities of the bits in W′; wherein when a first r′ columns of B_(W′) are a transpose of a systematic matrix and deg(λ(x))=t+r′, wherein 1≤r′≤r, performing: computing u(x)=gcd(λ(x), λ′(x)), wherein λ′(x) is a derivative of λ(x); computing λ(Φ\W′) and deducting from it Z_(λ(x),Φ)wherein Z_(λ(x),Φ)={βϵΦ: λ(β)=0}, when u(x) is a scalar in F*; adding a pair (λ(x), Z_(λ(x),Φ)) to set a L of all (r′, λ(x), Z_(λ(x),Φ)) such that 1≤r′≤r, λ(x)ϵV′_(r′), |Z_(λ(x),W)|≥r′+1, and |Z_(λ(x),Φ)|=t+r′, when |Z_(λ(x),Φ)|=t+r′; and outputting the set L.
 18. The computer memory-based product of claim 17, wherein the memory is at least one of a solid-state drive, a universal flash storage, or a DRAM. 